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IN THE CLAIMS; 

Please amend the claims as follows: 

1 . (Currently Amended) A method of reconstructing a voice call session, the 
method comprising: 

identifying a voice call prepaid account associated with a user; 
receiving a plurality of packets over a network interface, the packets being 
representative of a voice call over a network; 
filtering the received packets; 

analyzing the filtered plurality of packets to identify at least a first flow; 

identifying an application for the at least a first flow; 

selecting a corresponding application flow identifier for the application; 

using the corresponding application flow identifier to identify a plurality of flows 
in the plurality of packets corresponding to the session; 

altering accounting operations based on a type of the identified application: 

charging for the voice call against the voice call prepaid account; and 

terminating access to voice calls by the user if the voice call prepaid account is 
exceeded^ 

wherein application events including adding participants and removing 
participants are detected and accounted for accordingly: 

wherein a latency associated with the voice call is compared to a predetermined 
latency amount, and a compensation is given based on the comparison; 

wherein addition and removal of call legs are tracked and corresponding service 
detail records are generated based thereon . 

2. (Original) The method of claim 1 further comprising generating a quality 
of service report for the session based on the application. 
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3. (Original) The method of claim 1 wherein the session is associated with an 
end user experience occurring within a definite time bound. 

4. (Original) The method of claim 3 wherein the session is comprised of one 
or more additional sessions. 

5. (Cancelled) 

6. (Original) The method of claim 1 further comprising outputting a plurality 
of service detail records at predetermined intervals for the application, each service detail 
record including a billing identifier and a usage information, the usage information 
derived from the number of packets in the session during the corresponding 
predetermined interval. 

7. (Original) The method of claim 1 further comprising sending a command 
to a network device to control the session based on a policy, the policy defining a quality 
of service for the application. 

8. (Original) The method of claim 1 further comprising sending a command 
to a network device to control the session based on a policy, the policy defining the 
amount of resources available to the session. 

9. (Original) The method of claim 1 further comprising sending a command 
to a network device to stop the session based on a policy, the policy specifying a cost for 
use of resources and the policy triggering the transmission of the command upon the cost 
exceeding a predetermined amount. 

10. (Currently Amended) A system for reconstructing a voice call session, the 
system comprising; 

a packet source, the packet source generating a plurality of packets, wherein the 
packets are filtered and are representative of a voice call over a network; 
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a flow manager coupled to the packet source, the flow manager identifying at least 
one flow in the plurality of packets; 

an application recognizer coupled to the flow manager, the application recognizer 
identifying an application corresponding to the at least one flow; 

a session streamer coupled to the flow manager, the session streamer identifying a 
plurality of flows in the plurality of packets corresponding to the session based on the 
application; 

wherein a voice call prepaid account associated with a user is identified, 
accounting operations are altered based on a type of the identified application, the voice 
call is charged for against the voice call prepaid account, and access to voice calls by the 
user is terminated if the voice call prepaid account is exceeded: 

wherein application events including adding participants and removing 
participants are detected and accounted for accordingly; 

wherein a latency associated with the voice call is compared to a predetermined 
latency amount, and a compensation is given based on the comparison: 

wherein addition and removal of call legs are tracked and corresponding service 
detail records are generated based thereon , 

1 1 . (Previously Amended) The system of claim 1 0, wherein each of the 
plurality of packets includes a plurality of header elements and the at least one flow 
includes one or more packets with a common packet header element. 

12. (Original) The system of claim 10, wherein the application recognizer can 
identify at least one of a file transfer protocol (FTP), a hypertext transfer protocol 
(HTTP), a simple mail transport protocol (SMTP), a domain name service (DNS), a telnet 
protocol, a post office protocol (POP), an Internet message access protocol (IMAP), a 
network time protocol (NTP), a Netbios protocol, a network news transport protocol 
(NNTP), a network time protocol (NTP), a simple network management protocol 
(SNMP), an Internet Relay Chat (IRC) protocol, a H.323 protocol, a voice over IP 
protocol, a NetMeeting(TM) protocol, a Quicktime(TM) protocol, a server message block 
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(SMB) protocol, a RealAudio(TM) protocol, a real time streaming protocol (RTSP), and 
a real-time transport protocol (RTP). 

1 3. (Previously Amended) The system of claim 10, wherein the application 
recognizer signals to the session streamer to treat the at least one flow as a session when 
the application recognizer cannot identify an application for the at least one flow. 

14. (Original) The system of claim 1 0, further comprising a data collector 
coupled to the session streamer, the data collector for producing service detail records at 
predetermined intervals for the application corresponding to the session, each service 
detail record including a billing identifier and a usage information. 

1 5. (Currently Amended) An apparatus for reconstructing a voice call session, 
the apparatus comprising: 

means for identifying a voice call prepaid account associated with a user; 
means for receiving a plurality of packets, the packets being representative of a 
voice call over a network; 

means for filtering the received packets; 

means for identifying at least a first flow in the plurality of packets; 

means for identifying an application for the at least a first flow; 

means for selecting a corresponding application flow identifier for the application; 

means for identifying a plurality of flows in the plurality of packets corresponding 
to the session using the corresponding application flow identifier; 

means for altering accounting operations based on a type of the identified 
application; 

means for charging for the voice call against the voice call prepaid account; and 
means for terminating access to voice calls by the user if the voice call prepaid 

account is exceeded; 

wherein application events including adding participants and removing 

participants are detected and accounted for accordingly: 
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wherein a latency associated with the voice call is compared to a predetermined 
latency amount and a compensation is given based on the comparison; 

wherein addition and removal of call tegs are tracked and corresponding service 
detail records are generated based thereon . 

16. (Original) The apparatus of claim 15, further comprising means for 
reporting application appropriate performance characteristics for the session. 

17. (Original) The apparatus of claim 15, further comprising means for 
controlling a network device according to a policy, the policy defining the amount of 
resources available to the session. 

18. (Cancelled) 

1 9. (Currently Amended) A computer data signal e mbodied in a carrier wave 
computer program product embodied on a computer readable medium, comprising: 

a computer program for session reconstruction: 

a first set of instructions for identifying at least one flow in a plurality of 
packets; 

a second set of instructions for analyzing the at least one flow to identify 

an application corresponding to the flow; and 

a third set of instructions for identifying a plurality of flows in the plurality 

of packets corresponding to the session based on the application; 

wherein a voice call prepaid account associated with a user is identified, 
accounting operations are altered based on a type of the identified application, the voice 
call is charged for against the voice call prepaid account, and access to voice calls by the 
user is terminated if the voice call prepaid account is exceeded; 

wherein application events including addinp participants and removing 
participants are detected and accounted for accordingly; 

wherein a latency associated with the voice call is compared to a predetermined 
latency amount, and a compensation is given based on the comparison; 
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wherein addition and removal of call legs are tracked and corresponding service 
detail records are generated based thereon . 

20. (New) The method of claim 1 . wherein the reconstructed session analyzed, a N 
plurality of statistics associated with the session are gathered based on the analysis, a 
policy is determined, and the accounting operations are performed based on the policy. 

21 . (New) The method of claim 20, wherein the statistics include start time, end time, 
time since last output, number of packets, number of bytes, average time between 
packets, moving average, latency, throughput, and jitter. 

22. (New) The method of claim 20, wherein an aspect associated with an output of 
records is based on the identified application. 

23. (New) The method of claim 20, wherein the statistics are gathered from a plurality 
of layers of a network protocol. 

24. (New) The method of claim 23, wherein the layers of the network protocol 
include a physical layer, a data link layer, a network layer, a transport layer, a session 
layer, a presentation layer, and an application layer. 

25. (New) The method of claim 20, and further comprising filtering the packets for 
removing packets unrelated to the session. 

26. (New) The method of claim 20, and further comprising gathering a plurality of 
flow statistics associated with the plurality of flows. 

27. (New) The method of claim 26, wherein the flow statistics include timestamps. 

28. (New) The method of claim 27, wherein the timestamps are used to generate the 
statistics associated with the session. 
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29. (New) The method of claim 20, and further comprising outputting a plurality of 
reports including a plurality of the statistics reported in terms of the identified application. 

30. (New) The method of claim 29, wherein the reports are outputted at an interval. 

3 1 . (New) The method of claim 29, wherein the reports are outputted at an 
application-specific interval. 

32. (New) The method of claim 20, wherein the statistics are gathered based on the 
policy. 
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